The question “are there errors in the network?” is a very easy one to ask, but is actually quite a difficult one to answer. There are basically two types of error, Layer 2 (Ethernet errors) and Layer 3 (TCP/IP errors).
Layer 2 errors are associated with the NIC cards and drivers in the PCs and Servers. These are generally to do with how the Ethernet frames are formed and whether they conform to the rules correctly. These errors are counted by the same devices that give us SNMP statistics (such as SolarWinds Orion), hence we can generate reports telling us whether such issues are present in our networks.
The problem here is that most switches claim to filter errors and stop them spreading around your network. In reality as most switch vendors prioritize on fast switching times, filtering errors is something that slows them down. Each manufacturer has a different approach to this issue, but at the present time the most popular switches tend to let small numbers of errors through and only start to filter when the error levels get too high (usually around 1-2%). Again the SNMP tools are able to report on this.
A twist on this is the rise in broadcast and multicast traffic. These frames are perfectly valid in network operation, but too many of them will quickly slow a network down. These are growing due to the rise in applications such as video, e-learning etc which require a number of PCs to receive the same packets together. Monitoring is required here to and again SNMP tools can do the job.
Layer 3 errors are TCP based and are associated with the delivery of data around the network. The rules of TCP require packets to be acknowledged and corrections made if data is not received. These are perfectly valid Ethernet frames, hence SNMP tools do not record them, however they contain error messages which are very helpful. At this layer are also flow control messages which indicate that buffers are getting full and transactions are slowing down, which again are very useful for investigating network issues.
To look at this layer’s error messages we need a different technology and here the packet analyser tools (such as Network Instruments Observer) are very useful. All of them will have the ability to see these error types, but the better ones will organize the data against conversation flows to make it simple to see how easily data is being moved.
If we move inside the packet some more, there will also be application errors as well. A typical example of this would be a “page 404 error” (page not found) from your browser. These frames have been perfectly transmitted and received around your network only for the application software to fail them at the end of their journey. Again these can be very useful in solving issues, particularly in proving that the network was not at fault.
At this level the better packet analysers (such as Observer) can understand these error messages and report on how efficiently the applications are in handling the requests being sent to them.
In summary, there are errors at many different levels and depending on which ones you want to see you will need a different tool to help.
Return to Article Go on to Dropped Packets
Last Updated: 08/12/2009